| Package | Affected versions | Patched versions |
|---|---|---|
| flowise | < 3.1.3 | 3.1.3 |
Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free